MavenPackage

org.apache.zookeeper:zookeeper

19 known vulnerabilities (2 critical, 7 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release: 3.9.7 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 3.9.7 (Oct 22, 2026), the latest release
Advisories: 19 · 2 critical, 7 high, 7 medium

Dependents: 175
Releases: 58 since 3.3.0 (Mar 19, 2010)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-100302
Affects 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it)
CVE-2026-115448
Affects 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it)
CVE-2026-100300
Affects 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it)
CVE-2026-100252
Affects 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it)
CVE-2026-100235
Affects 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it)
CVE-2026-84501
Affects 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it)
CVE-2026-84439
Affects 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it)
CVE-2026-79993
Affects 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it)
CVE-2026-59969
Affects 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it)
CVE-2026-59739
Affects 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it)
CVE-2026-24308
Affects 3.8.0 to 3.8.5 (3.8.6 is outside it); 3.9.0 to 3.9.4 (3.9.5 is outside it)
CVE-2026-24281
Affects 3.8.0 to 3.8.5 (3.8.6 is outside it); 3.9.0 to 3.9.4 (3.9.5 is outside it)

Show all 19 advisoriesShow fewer advisories

CVE-2025-58457
Affects 3.9.0 to 3.9.3 (3.9.4 is outside it)
CVE-2024-51504
Affects 3.9.0 to 3.9.2 (3.9.3 is outside it)
CVE-2024-23944
Affects 3.6.0 to 3.8.3 (3.8.4 is outside it); 3.9.0 to 3.9.1 (3.9.2 is outside it)
CVE-2023-44981
Affects 3.3.0 to 3.7.1 (3.7.2 is outside it); 3.8.0 to 3.8.2 (3.8.3 is outside it); 3.9.0 (3.9.1 is outside it)
CVE-2019-0201
Affects 3.3.0 to 3.4.13 (3.4.14 is outside it); 3.5.1-alpha to 3.5.4-beta (3.5.5 is outside it)
CVE-2018-8012
Affects 3.3.0 to 3.4.9 (3.4.10 is outside it); 3.5.0-alpha to 3.5.3-beta (3.5.4-beta is outside it)
CVE-2017-5637
Affects 3.4.0 to 3.4.9 (3.4.10 is outside it); 3.5.1-alpha to 3.5.3-beta (3.5.4-beta is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

CVE-2026-100302High 7.1
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7.
Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-115448High 8.7
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7.
Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-100300High 8.7
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply…
Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7.
Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-100252High 8.6
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7.
Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-100235Medium 6.0
Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7.
Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-84501Medium 5.3
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6.
Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-84439Medium 5.3
Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6.
Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-79993High 7.5
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6.
Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-59969High 7.5
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6.
Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-59739High 7.5
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6.
Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.7, is not affected.
CVE-2026-24308Medium 6.5
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Affected: from 3.9.0, through 3.9.4; from 3.8.0, through 3.8.5; from 3.9.0, fixed in 3.9.5; from 3.8.0, fixed in 3.8.6.
Fixed in 3.8.6 (released Jan 28, 2026, 38 days before disclosure) and 3.9.5 (released Feb 11, 2026, 24 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2026-24281Medium 5.9
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Affected: from 3.9.0, through 3.9.4; from 3.8.0, through 3.8.5; from 3.8.0, fixed in 3.8.6; from 3.9.0, fixed in 3.9.5.
Fixed in 3.8.6 (released Jan 28, 2026, 38 days before disclosure) and 3.9.5 (released Feb 11, 2026, 24 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2025-58457Medium 4.3
Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands
Affected: from 3.9.0, fixed in 3.9.4; from 3.9.0, fixed in 3.9.4.
Fixed in 3.9.4 (released Aug 19, 2025, 36 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2024-51504Critical 9.1
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
Affected: from 3.9.0, fixed in 3.9.3; from 3.9.0, fixed in 3.9.3.
Fixed in 3.9.3 (released Oct 17, 2024, 21 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2024-23944Medium 5.3
Apache ZooKeeper: Information disclosure in persistent watcher handling
Affected: from 3.9.0, through 3.9.1; from 3.8.0, through 3.8.3; from 3.6.0, through 3.7.2; from 3.8.0, fixed in 3.8.4; from 3.9.0, fixed in 3.9.2; from 3.6.0, through 3.7.2.
Fixed in 3.8.4 (released Feb 12, 2024, 32 days before disclosure) and 3.9.2 (released Feb 12, 2024, 32 days before disclosure).
The latest release, 3.9.7, is not affected.

Show all 19 advisoriesShow fewer advisories

CVE-2023-44981Critical 9.1
Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication
Affected: from 3.9.0, fixed in 3.9.1; from 3.8.0, through 3.8.2; from 3.7.0, through 3.7.1; fixed in 3.7.0; fixed in 3.7.2; from 3.8.0, fixed in 3.8.3; from 3.9.0, fixed in 3.9.1.
Fixed in 3.7.2 (released Oct 6, 2023, 5 days before disclosure), 3.8.3 (released Oct 5, 2023, 6 days before disclosure) and 3.9.1 (released Oct 2, 2023, 9 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2019-0201Unrated
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.
Affected: from 1.0.0, fixed in 3.4.14; from 3.5.0, fixed in 3.5.5.
Fixed in 3.4.14 (released Mar 6, 2019, 78 days before disclosure) and 3.5.5 (released May 3, 2019, 20 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2018-8012Unrated
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha…
Affected: fixed in 3.4.10; from 3.5.0-alpha, fixed in 3.5.4-beta.
Fixed in 3.4.10 (released Mar 23, 2017, 424 days before disclosure) and 3.5.4-beta (released May 11, 2018, 10 days before disclosure).
The latest release, 3.9.7, is not affected.
CVE-2017-5637Unrated
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused…
Affected: from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.3.
Fixed in 3.4.10 (released Mar 23, 2017, 201 days before disclosure) and 3.5.5 (released May 3, 2019, 570 days after disclosure, the advisory names 3.5.3, which was never published).
The latest release, 3.9.7, is not affected.